Add feature - Impersonate AAD user to internal domain user

Author: Munib Ahmed

AxaptaApiApp/App_Start/ServiceConfig.cs

@@ -15,6 +15,7 @@ public enum AuthenticationMode
             ActiveDirectory,
             ActiveDirectorySingleUser,
             ThirdPartyProvider,
+            Impersonate,
             NotDefined
         };
 
@@ -36,7 +37,8 @@ public static NetworkCredential NetworkCredential()
 
         public static AuthenticationMode GetAuthenticationMode()
         {
-            if (Int32.TryParse(ConfigurationManager.AppSettings["API_AUTH_MODE"], out int mode))
+            int mode = 0;
+            if (Int32.TryParse(ConfigurationManager.AppSettings["API_AUTH_MODE"], out mode))
             {
                 switch (mode)
                 {
@@ -46,6 +48,8 @@ public static AuthenticationMode GetAuthenticationMode()
                         return AuthenticationMode.ActiveDirectorySingleUser;
                     case 3:
                         return AuthenticationMode.ThirdPartyProvider;
+                    case 4:
+                        return AuthenticationMode.Impersonate;
                     default:
                         return AuthenticationMode.NotDefined;
                 }

AxaptaApiApp/Handlers/BasicAuthHandler.cs

@@ -20,6 +20,7 @@ protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage reques
                     break;
                 case ServiceConfig.AuthenticationMode.ActiveDirectorySingleUser:
                 case ServiceConfig.AuthenticationMode.ThirdPartyProvider:
+                case ServiceConfig.AuthenticationMode.Impersonate:
                     identity = ServiceConfig.ParseUserCredential();
                     break;
             }

AxaptaApiApp/Utils/ClientFactory.cs

@@ -1,5 +1,9 @@
 using System;
 using System.Web;
+using System.Configuration;
+using System.Net.Mail;
+using System.Security.Principal;
+using System.Security.Claims;
 
 namespace AxaptaApiApp.Utils
 {
@@ -46,6 +50,23 @@ public static class ClientFactory
                             HttpContext.Current.User.Identity.AuthenticationType,
                             HttpContext.Current.User.Identity.Name);
                 }
+                else if (ServiceConfig.GetAuthenticationMode() == ServiceConfig.AuthenticationMode.Impersonate)
+                {
+                    string domain = HttpContext.Current.User.Identity.AuthenticationType;
+                    string username = "";
+                    ClaimsPrincipal claimsPrincipal = HttpContext.Current.User as ClaimsPrincipal;
+                    string email = claimsPrincipal.FindFirst(ClaimTypes.Upn) != null ? claimsPrincipal.FindFirst(ClaimTypes.Upn).Value : claimsPrincipal.FindFirst(ClaimTypes.Email).Value;
+
+                    //aad is Azure Active Directory - if aad is used then use the internal network domain name from the app settings
+                    //Other possible values are Google, Facebook, Twitter - for those we will pass direct to AX as a claims user
+                    if (String.Equals(domain, "aad"))
+                    {
+                        domain = ConfigurationManager.AppSettings["API_AUTH_USER_DOMAIN"];
+                        MailAddress addr = new MailAddress(email); //takes [email protected]
+                        username = addr.User;                      //returns username
+                    }
+                    context.LogonAsUser = String.Format("{0}\\{1}", domain, username);
+                }
 
                 return context;
             }

AxaptaApiApp/Web.config

@@ -7,7 +7,9 @@
     
       Mode 1: Multi-User (Active Directory)
       Mode 2: Single-User (Active Directory)
-      Mode 3: Third-Party Provider
+      Mode 3: Third-Party Provider - Impersonates but takes the authenticate type and name 
+      Mode 4: Impersonate - uses the API_AUTH_USER_DOMAIN and the username from the email to resolve a string like domain\username
+                          - this is used usually when you are syncing your onpremise AD to Azure AD
     -->
     <add key="API_AUTH_MODE" value="2" />
     <add key="API_AUTH_USER_DOMAIN" value="" />